Password Generator
A password generator that shows its working: every character comes from your browser’s cryptographic random number generator, and the strength readout is real entropy in bits — not a colour-coded guess.
How to use Password Generator
- Choose password mode for a random character string, or passphrase mode for a memorable Diceware-style phrase.
- Set the length (or the number of words) and tick the character sets you need — lowercase, uppercase, digits and symbols.
- Turn on “exclude ambiguous characters” if the password will ever be read aloud or typed from a screenshot.
- Check the entropy readout and crack-time estimate, then copy the password straight into your password manager.
- Need a batch? Raise the quantity to generate up to 100 at once and download them as a text file.
About Password Generator
Most password generators are a black box with a coloured bar. You are told a password is “Strong” without being told what that means, and the meter is usually scoring a regular expression — does it contain a capital letter, a digit, a symbol — rather than measuring anything. That is exactly why P@ssw0rd1 lights up green on half the internet while falling to a dictionary attack in under a second. This tool replaces the guesswork with arithmetic: entropy in bits, computed from the actual character pool and the actual length, and a crack time derived from that number.
The randomness matters just as much as the maths. Every character here is drawn from crypto.getRandomValues(), the browser’s CSPRNG, and mapped onto your chosen alphabet using rejection sampling rather than the modulo operator. That detail is invisible but real: because 256 is not a multiple of 62, a naive byte % 62 makes the first few characters of the alphabet measurably more likely than the rest. Discarding out-of-range bytes instead keeps the distribution perfectly uniform, so the entropy figure quoted is the entropy you actually get.
Passphrase mode implements Diceware with a hand-curated list of about 2,600 short, common English words — no apostrophes, no accents, nothing awkward on a phone keyboard. Choose the word count, the separator and the capitalisation, optionally append a digit, and the readout recalculates from the real list size. Because the words are selected independently and uniformly, a six-word phrase carries roughly 68 bits of entropy whether or not it happens to read like a sentence, and it is dramatically easier to type on a games console or a TV remote than a random symbol soup.
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are generated in your browser by crypto.getRandomValues(), the same cryptographically secure random source browsers use for TLS key material. Nothing is sent over the network, written to a server, or saved anywhere — close the tab and the password is gone unless you copied it.
Are the generated passwords stored or logged?
No. There is no server involved at any point, no analytics event carrying the value, and nothing written to local storage except your settings (length, character sets). You can verify this by opening your browser’s network tab while generating — it stays empty.
How strong should a password be?
Aim for at least 80 bits of entropy for anything that matters, which is roughly a 14-character password using all four character sets, or a 7-word passphrase. Below about 60 bits an attacker with a rented GPU cluster can work through the whole keyspace; above 100 bits brute force stops being a realistic threat entirely.
What is a passphrase and is it really as strong as a password?
A passphrase is several unrelated words chosen at random from a large list — the Diceware method. Strength comes from the number of possible word combinations, not from odd spelling, so correct-battery-horse-staple style phrases are both far easier to type and stronger than most short passwords. Each word from our 2,600-word list adds about 11.3 bits.
How is the crack time estimated?
From the entropy alone, assuming an offline attacker who has stolen the password hash and can test 100 billion candidates per second — realistic for a fast hash such as MD5 or unsalted SHA-1 on modern GPUs. The figure shown is the average, which is half the keyspace. Against a slow hash like bcrypt or Argon2 the real time would be far longer.
Does “no repeated characters” make a password stronger?
No — it makes it slightly weaker, and the entropy readout reflects that honestly. Forbidding repeats shrinks the pool with every character chosen, so a 16-character password from a 70-symbol pool drops from about 98 bits to roughly 93. It is useful when a system or a human genuinely cannot handle repeats, not as a security measure.
Related tools
- Random Number Generator — Numbers, dice, coins, lists & teams
- QR Code Generator — Free QR codes as PNG or SVG
- UUID Generator — UUID v4 & v7, ULID and NanoID
- Color Palette Generator — Harmonies with WCAG contrast checks
- JWT Decoder — Decode and verify JSON Web Tokens
- Hash Generator — MD5, SHA, CRC32 & HMAC checksums